NHibernate Release Notes

4.0.0.x Releases

This release keeps NES for NHibernate on the 4.0.0.x line while backporting the SQL injection fix delivered upstream in NHibernate 5.4.9, so consumers get the fix without moving to NHibernate 5.
The assembly version stays 4.0.0.4000, so the package is a drop-in replacement for NHibernate 4.0.0.4000.

SQL literal escaping: Types that render values as SQL literals (ILiteralType.ObjectToSQLString) now build them through the new Dialect.ToStringLiteral, which doubles quotes, escapes backslashes where the database treats them as escape characters, and adds an N prefix to Unicode strings where the database needs it. Numeric and tick-based types now format with the invariant culture. Previously, string, character, Guid, Uri and date and time values were wrapped in quotes without escaping, and numbers were formatted with the current culture, so a crafted value in a discriminator, an HQL reference to a static field, or SqlInsertBuilder / SqlUpdateBuilder.AddColumn could inject SQL.
- Fixes a SQL injection vulnerability (CVE-2024-39677).

SQL Server, MySQL, Oracle, Ingres and SQL Anywhere now prefix Unicode string literals with N, and DB2 renders them as U& literals. Tests that compare generated SQL text exactly may need updating.
MySQL and SQL Anywhere now escape backslashes in string literals. The new escape_backslash_in_strings configuration setting overrides the dialect default, for example when a MySQL server runs with NO_BACKSLASH_ESCAPES.
NuGet audit still reports NU1903 for this version, because the advisory covers every version below 5.4.9. See NuGet Audit Warning to suppress it.

First NES release of NHibernate 4.0.0.4000. The code is unchanged from upstream; this release adds NES licensing and versioning only.